ClawHub
Back to skill

Security audit

huangli-almanac

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a simple almanac/date lookup tool that sends date inputs to a third-party API, with no evidence of credential theft, persistence, destructive behavior, or hidden high-impact authority.

Install only if you are comfortable with the skill sending queried dates to api.tiax.cn and relying on that service's responses. Avoid using it for highly private event dates unless you accept that third-party processing.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill tells users to submit dates that are then sent to `tiax.cn`, but it does not warn that the input will be transmitted to a third-party service. Even though dates are not highly sensitive by default, queried dates can reveal personal events such as weddings, moves, funerals, or birthdays, creating a privacy leak through undisclosed external processing.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The implementation section contains direct `curl` examples to an external endpoint but gives no user-facing warning that invoking the skill causes network access. This is risky because users may assume the skill operates locally, while in reality their inputs are sent off-platform to a third party with unknown logging, retention, or availability characteristics.

External Transmission

Medium
Category
Data Exfiltration
Content
set -e

# 默认 API 地址
API_BASE="https://api.tiax.cn/almanac/"

# 解析参数
YEAR=""
Confidence
83% confidence
Finding
The script sends user-supplied date queries to an external third-party service over the network. While the transmitted data is low sensitivity in this case, using an unauthenticated external API introduces privacy, availability, and trust risks because responses are fully controlled by that service and may change, fail, or be misleading.

Static analysis

No suspicious patterns detected.